1
          
          require 'active_support/test_case'
        
      
        

          1
          
          require 'rails-dom-testing'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionMailer
        
      
        

          1
          
            class NonInferrableMailerError < ::StandardError
        
      
        

          1
          
              def initialize(name)
        
      
        

          
          
                super "Unable to determine the mailer to test from #{name}. " +
        
      
        

          
          
                  "You'll need to specify it using tests YourMailer in your " +
        
      
        

          
          
                  "test case definition"
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            class TestCase < ActiveSupport::TestCase
        
      
        

          1
          
              module Behavior
        
      
        

          1
          
                extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
                include ActiveSupport::Testing::ConstantLookup
        
      
        

          1
          
                include TestHelper
        
      
        

          1
          
                include Rails::Dom::Testing::Assertions::SelectorAssertions
        
      
        

          1
          
                include Rails::Dom::Testing::Assertions::DomAssertions
        
      
        

          
          
          
        
      
        

          1
          
                included do
        
      
        

          1
          
                  class_attribute :_mailer_class
        
      
        

          1
          
                  setup :initialize_test_deliveries
        
      
        

          1
          
                  setup :set_expected_mail
        
      
        

          1
          
                  teardown :restore_test_deliveries
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                module ClassMethods
        
      
        

          1
          
                  def tests(mailer)
        
      
        

          
          
                    case mailer
        
      
        

          
          
                    when String, Symbol
        
      
        

          
          
                      self._mailer_class = mailer.to_s.camelize.constantize
        
      
        

          
          
                    when Module
        
      
        

          
          
                      self._mailer_class = mailer
        
      
        

          
          
                    else
        
      
        

          
          
                      raise NonInferrableMailerError.new(mailer)
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def mailer_class
        
      
        

          
          
                    if mailer = self._mailer_class
        
      
        

          
          
                      mailer
        
      
        

          
          
                    else
        
      
        

          
          
                      tests determine_default_mailer(name)
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def determine_default_mailer(name)
        
      
        

          
          
                    mailer = determine_constant_from_test_name(name) do |constant|
        
      
        

          
          
                      Class === constant && constant < ActionMailer::Base
        
      
        

          
          
                    end
        
      
        

          
          
                    raise NonInferrableMailerError.new(name) if mailer.nil?
        
      
        

          
          
                    mailer
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                protected
        
      
        

          
          
          
        
      
        

          1
          
                  def initialize_test_deliveries
        
      
        

          
          
                    set_delivery_method :test
        
      
        

          
          
                    @old_perform_deliveries = ActionMailer::Base.perform_deliveries
        
      
        

          
          
                    ActionMailer::Base.perform_deliveries = true
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def restore_test_deliveries
        
      
        

          
          
                    restore_delivery_method
        
      
        

          
          
                    ActionMailer::Base.perform_deliveries = @old_perform_deliveries
        
      
        

          
          
                    ActionMailer::Base.deliveries.clear
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def set_delivery_method(method)
        
      
        

          
          
                    @old_delivery_method = ActionMailer::Base.delivery_method
        
      
        

          
          
                    ActionMailer::Base.delivery_method = method
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def restore_delivery_method
        
      
        

          
          
                    ActionMailer::Base.delivery_method = @old_delivery_method
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def set_expected_mail
        
      
        

          
          
                    @expected = Mail.new
        
      
        

          
          
                    @expected.content_type ["text", "plain", { "charset" => charset }]
        
      
        

          
          
                    @expected.mime_version = '1.0'
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                private
        
      
        

          
          
          
        
      
        

          1
          
                  def charset
        
      
        

          
          
                    "UTF-8"
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def encode(subject)
        
      
        

          
          
                    Mail::Encodings.q_value_encode(subject, charset)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def read_fixture(action)
        
      
        

          
          
                    IO.readlines(File.join(Rails.root, 'test', 'fixtures', self.class.mailer_class.name.underscore, action))
        
      
        

          
          
                  end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              include Behavior
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionMailer
        
      
        

          
          
            # Provides helper methods for testing Action Mailer, including #assert_emails
        
      
        

          
          
            # and #assert_no_emails
        
      
        

          1
          
            module TestHelper
        
      
        

          
          
              # Asserts that the number of emails sent matches the given number.
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_emails
        
      
        

          
          
              #     assert_emails 0
        
      
        

          
          
              #     ContactMailer.welcome.deliver_now
        
      
        

          
          
              #     assert_emails 1
        
      
        

          
          
              #     ContactMailer.welcome.deliver_now
        
      
        

          
          
              #     assert_emails 2
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # If a block is passed, that block should cause the specified number of
        
      
        

          
          
              # emails to be sent.
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_emails_again
        
      
        

          
          
              #     assert_emails 1 do
        
      
        

          
          
              #       ContactMailer.welcome.deliver_now
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     assert_emails 2 do
        
      
        

          
          
              #       ContactMailer.welcome.deliver_now
        
      
        

          
          
              #       ContactMailer.welcome.deliver_now
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          1
          
              def assert_emails(number)
        
      
        

          
          
                if block_given?
        
      
        

          
          
                  original_count = ActionMailer::Base.deliveries.size
        
      
        

          
          
                  yield
        
      
        

          
          
                  new_count = ActionMailer::Base.deliveries.size
        
      
        

          
          
                  assert_equal number, new_count - original_count, "#{number} emails expected, but #{new_count - original_count} were sent"
        
      
        

          
          
                else
        
      
        

          
          
                  assert_equal number, ActionMailer::Base.deliveries.size
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Assert that no emails have been sent.
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_emails
        
      
        

          
          
              #     assert_no_emails
        
      
        

          
          
              #     ContactMailer.welcome.deliver_now
        
      
        

          
          
              #     assert_emails 1
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # If a block is passed, that block should not cause any emails to be sent.
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_emails_again
        
      
        

          
          
              #     assert_no_emails do
        
      
        

          
          
              #       # No emails should be sent from this block
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # Note: This assertion is simply a shortcut for:
        
      
        

          
          
              #
        
      
        

          
          
              #   assert_emails 0
        
      
        

          1
          
              def assert_no_emails(&block)
        
      
        

          
          
                assert_emails 0, &block
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'action_view'
        
      
        

          1
          
          require "action_controller/log_subscriber"
        
      
        

          1
          
          require "action_controller/metal/params_wrapper"
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # Action Controllers are the core of a web request in \Rails. They are made up of one or more actions that are executed
        
      
        

          
          
            # on request and then either it renders a template or redirects to another action. An action is defined as a public method
        
      
        

          
          
            # on the controller, which will automatically be made accessible to the web-server through \Rails Routes.
        
      
        

          
          
            #
        
      
        

          
          
            # By default, only the ApplicationController in a \Rails application inherits from <tt>ActionController::Base</tt>. All other
        
      
        

          
          
            # controllers in turn inherit from ApplicationController. This gives you one class to configure things such as
        
      
        

          
          
            # request forgery protection and filtering of sensitive request parameters.
        
      
        

          
          
            #
        
      
        

          
          
            # A sample controller could look like this:
        
      
        

          
          
            #
        
      
        

          
          
            #   class PostsController < ApplicationController
        
      
        

          
          
            #     def index
        
      
        

          
          
            #       @posts = Post.all
        
      
        

          
          
            #     end
        
      
        

          
          
            #
        
      
        

          
          
            #     def create
        
      
        

          
          
            #       @post = Post.create params[:post]
        
      
        

          
          
            #       redirect_to posts_path
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # Actions, by default, render a template in the <tt>app/views</tt> directory corresponding to the name of the controller and action
        
      
        

          
          
            # after executing code in the action. For example, the +index+ action of the PostsController would render the
        
      
        

          
          
            # template <tt>app/views/posts/index.html.erb</tt> by default after populating the <tt>@posts</tt> instance variable.
        
      
        

          
          
            #
        
      
        

          
          
            # Unlike index, the create action will not render a template. After performing its main purpose (creating a
        
      
        

          
          
            # new post), it initiates a redirect instead. This redirect works by returning an external
        
      
        

          
          
            # "302 Moved" HTTP response that takes the user to the index action.
        
      
        

          
          
            #
        
      
        

          
          
            # These two methods represent the two basic action archetypes used in Action Controllers. Get-and-show and do-and-redirect.
        
      
        

          
          
            # Most actions are variations on these themes.
        
      
        

          
          
            #
        
      
        

          
          
            # == Requests
        
      
        

          
          
            #
        
      
        

          
          
            # For every request, the router determines the value of the +controller+ and +action+ keys. These determine which controller
        
      
        

          
          
            # and action are called. The remaining request parameters, the session (if one is available), and the full request with
        
      
        

          
          
            # all the HTTP headers are made available to the action through accessor methods. Then the action is performed.
        
      
        

          
          
            #
        
      
        

          
          
            # The full request object is available via the request accessor and is primarily used to query for HTTP headers:
        
      
        

          
          
            #
        
      
        

          
          
            #   def server_ip
        
      
        

          
          
            #     location = request.env["REMOTE_ADDR"]
        
      
        

          
          
            #     render plain: "This server hosted at #{location}"
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # == Parameters
        
      
        

          
          
            #
        
      
        

          
          
            # All request parameters, whether they come from a GET or POST request, or from the URL, are available through the params method
        
      
        

          
          
            # which returns a hash. For example, an action that was performed through <tt>/posts?category=All&limit=5</tt> will include
        
      
        

          
          
            # <tt>{ "category" => "All", "limit" => "5" }</tt> in params.
        
      
        

          
          
            #
        
      
        

          
          
            # It's also possible to construct multi-dimensional parameter hashes by specifying keys using brackets, such as:
        
      
        

          
          
            #
        
      
        

          
          
            #   <input type="text" name="post[name]" value="david">
        
      
        

          
          
            #   <input type="text" name="post[address]" value="hyacintvej">
        
      
        

          
          
            #
        
      
        

          
          
            # A request stemming from a form holding these inputs will include <tt>{ "post" => { "name" => "david", "address" => "hyacintvej" } }</tt>.
        
      
        

          
          
            # If the address input had been named <tt>post[address][street]</tt>, the params would have included
        
      
        

          
          
            # <tt>{ "post" => { "address" => { "street" => "hyacintvej" } } }</tt>. There's no limit to the depth of the nesting.
        
      
        

          
          
            #
        
      
        

          
          
            # == Sessions
        
      
        

          
          
            #
        
      
        

          
          
            # Sessions allow you to store objects in between requests. This is useful for objects that are not yet ready to be persisted,
        
      
        

          
          
            # such as a Signup object constructed in a multi-paged process, or objects that don't change much and are needed all the time, such
        
      
        

          
          
            # as a User object for a system that requires login. The session should not be used, however, as a cache for objects where it's likely
        
      
        

          
          
            # they could be changed unknowingly. It's usually too much work to keep it all synchronized -- something databases already excel at.
        
      
        

          
          
            #
        
      
        

          
          
            # You can place objects in the session by using the <tt>session</tt> method, which accesses a hash:
        
      
        

          
          
            #
        
      
        

          
          
            #   session[:person] = Person.authenticate(user_name, password)
        
      
        

          
          
            #
        
      
        

          
          
            # And retrieved again through the same hash:
        
      
        

          
          
            #
        
      
        

          
          
            #   Hello #{session[:person]}
        
      
        

          
          
            #
        
      
        

          
          
            # For removing objects from the session, you can either assign a single key to +nil+:
        
      
        

          
          
            #
        
      
        

          
          
            #   # removes :person from session
        
      
        

          
          
            #   session[:person] = nil
        
      
        

          
          
            #
        
      
        

          
          
            # or you can remove the entire session with +reset_session+.
        
      
        

          
          
            #
        
      
        

          
          
            # Sessions are stored by default in a browser cookie that's cryptographically signed, but unencrypted.
        
      
        

          
          
            # This prevents the user from tampering with the session but also allows them to see its contents.
        
      
        

          
          
            #
        
      
        

          
          
            # Do not put secret information in cookie-based sessions!
        
      
        

          
          
            #
        
      
        

          
          
            # == Responses
        
      
        

          
          
            #
        
      
        

          
          
            # Each action results in a response, which holds the headers and document to be sent to the user's browser. The actual response
        
      
        

          
          
            # object is generated automatically through the use of renders and redirects and requires no user intervention.
        
      
        

          
          
            #
        
      
        

          
          
            # == Renders
        
      
        

          
          
            #
        
      
        

          
          
            # Action Controller sends content to the user by using one of five rendering methods. The most versatile and common is the rendering
        
      
        

          
          
            # of a template. Included in the Action Pack is the Action View, which enables rendering of ERB templates. It's automatically configured.
        
      
        

          
          
            # The controller passes objects to the view by assigning instance variables:
        
      
        

          
          
            #
        
      
        

          
          
            #   def show
        
      
        

          
          
            #     @post = Post.find(params[:id])
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # Which are then automatically available to the view:
        
      
        

          
          
            #
        
      
        

          
          
            #   Title: <%= @post.title %>
        
      
        

          
          
            #
        
      
        

          
          
            # You don't have to rely on the automated rendering. For example, actions that could result in the rendering of different templates
        
      
        

          
          
            # will use the manual rendering methods:
        
      
        

          
          
            #
        
      
        

          
          
            #   def search
        
      
        

          
          
            #     @results = Search.find(params[:query])
        
      
        

          
          
            #     case @results.count
        
      
        

          
          
            #       when 0 then render action: "no_results"
        
      
        

          
          
            #       when 1 then render action: "show"
        
      
        

          
          
            #       when 2..10 then render action: "show_many"
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # Read more about writing ERB and Builder templates in ActionView::Base.
        
      
        

          
          
            #
        
      
        

          
          
            # == Redirects
        
      
        

          
          
            #
        
      
        

          
          
            # Redirects are used to move from one action to another. For example, after a <tt>create</tt> action, which stores a blog entry to the
        
      
        

          
          
            # database, we might like to show the user the new entry. Because we're following good DRY principles (Don't Repeat Yourself), we're
        
      
        

          
          
            # going to reuse (and redirect to) a <tt>show</tt> action that we'll assume has already been created. The code might look like this:
        
      
        

          
          
            #
        
      
        

          
          
            #   def create
        
      
        

          
          
            #     @entry = Entry.new(params[:entry])
        
      
        

          
          
            #     if @entry.save
        
      
        

          
          
            #       # The entry was saved correctly, redirect to show
        
      
        

          
          
            #       redirect_to action: 'show', id: @entry.id
        
      
        

          
          
            #     else
        
      
        

          
          
            #       # things didn't go so well, do something else
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # In this case, after saving our new entry to the database, the user is redirected to the <tt>show</tt> method, which is then executed.
        
      
        

          
          
            # Note that this is an external HTTP-level redirection which will cause the browser to make a second request (a GET to the show action),
        
      
        

          
          
            # and not some internal re-routing which calls both "create" and then "show" within one request.
        
      
        

          
          
            #
        
      
        

          
          
            # Learn more about <tt>redirect_to</tt> and what options you have in ActionController::Redirecting.
        
      
        

          
          
            #
        
      
        

          
          
            # == Calling multiple redirects or renders
        
      
        

          
          
            #
        
      
        

          
          
            # An action may contain only a single render or a single redirect. Attempting to try to do either again will result in a DoubleRenderError:
        
      
        

          
          
            #
        
      
        

          
          
            #   def do_something
        
      
        

          
          
            #     redirect_to action: "elsewhere"
        
      
        

          
          
            #     render action: "overthere" # raises DoubleRenderError
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # If you need to redirect on the condition of something, then be sure to add "and return" to halt execution.
        
      
        

          
          
            #
        
      
        

          
          
            #   def do_something
        
      
        

          
          
            #     redirect_to(action: "elsewhere") and return if monkeys.nil?
        
      
        

          
          
            #     render action: "overthere" # won't be called if monkeys is nil
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          1
          
            class Base < Metal
        
      
        

          1
          
              abstract!
        
      
        

          
          
          
        
      
        

          
          
              # We document the request and response methods here because albeit they are
        
      
        

          
          
              # implemented in ActionController::Metal, the type of the returned objects
        
      
        

          
          
              # is unknown at that level.
        
      
        

          
          
          
        
      
        

          
          
              ##
        
      
        

          
          
              # :method: request
        
      
        

          
          
              #
        
      
        

          
          
              # Returns an ActionDispatch::Request instance that represents the
        
      
        

          
          
              # current request.
        
      
        

          
          
          
        
      
        

          
          
              ##
        
      
        

          
          
              # :method: response
        
      
        

          
          
              #
        
      
        

          
          
              # Returns an ActionDispatch::Response that represents the current
        
      
        

          
          
              # response.
        
      
        

          
          
          
        
      
        

          
          
              # Shortcut helper that returns all the modules included in
        
      
        

          
          
              # ActionController::Base except the ones passed as arguments:
        
      
        

          
          
              #
        
      
        

          
          
              #   class MyBaseController < ActionController::Metal
        
      
        

          
          
              #     ActionController::Base.without_modules(:ParamsWrapper, :Streaming).each do |left|
        
      
        

          
          
              #       include left
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # This gives better control over what you want to exclude and makes it
        
      
        

          
          
              # easier to create a bare controller class, instead of listing the modules
        
      
        

          
          
              # required manually.
        
      
        

          1
          
              def self.without_modules(*modules)
        
      
        

          
          
                modules = modules.map do |m|
        
      
        

          
          
                  m.is_a?(Symbol) ? ActionController.const_get(m) : m
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                MODULES - modules
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              MODULES = [
        
      
        

          
          
                AbstractController::Rendering,
        
      
        

          
          
                AbstractController::Translation,
        
      
        

          
          
                AbstractController::AssetPaths,
        
      
        

          
          
          
        
      
        

          
          
                Helpers,
        
      
        

          
          
                HideActions,
        
      
        

          
          
                UrlFor,
        
      
        

          
          
                Redirecting,
        
      
        

          
          
                ActionView::Layouts,
        
      
        

          
          
                Rendering,
        
      
        

          
          
                Renderers::All,
        
      
        

          
          
                ConditionalGet,
        
      
        

          
          
                EtagWithTemplateDigest,
        
      
        

          
          
                RackDelegation,
        
      
        

          
          
                Caching,
        
      
        

          
          
                MimeResponds,
        
      
        

          
          
                ImplicitRender,
        
      
        

          
          
                StrongParameters,
        
      
        

          
          
          
        
      
        

          
          
                Cookies,
        
      
        

          
          
                Flash,
        
      
        

          
          
                RequestForgeryProtection,
        
      
        

          
          
                ForceSSL,
        
      
        

          
          
                Streaming,
        
      
        

          
          
                DataStreaming,
        
      
        

          
          
                HttpAuthentication::Basic::ControllerMethods,
        
      
        

          
          
                HttpAuthentication::Digest::ControllerMethods,
        
      
        

          
          
                HttpAuthentication::Token::ControllerMethods,
        
      
        

          
          
          
        
      
        

          
          
                # Before callbacks should also be executed the earliest as possible, so
        
      
        

          
          
                # also include them at the bottom.
        
      
        

          
          
                AbstractController::Callbacks,
        
      
        

          
          
          
        
      
        

          
          
                # Append rescue at the bottom to wrap as much as possible.
        
      
        

          
          
                Rescue,
        
      
        

          
          
          
        
      
        

          
          
                # Add instrumentations hooks at the bottom, to ensure they instrument
        
      
        

          
          
                # all the methods properly.
        
      
        

          
          
                Instrumentation,
        
      
        

          
          
          
        
      
        

          
          
                # Params wrapper should come before instrumentation so they are
        
      
        

          
          
                # properly showed in logs
        
      
        

          
          
                ParamsWrapper
        
      
        

          
          
              ]
        
      
        

          
          
          
        
      
        

          1
          
              MODULES.each do |mod|
        
      
        

          30
          
                include mod
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Define some internal variables that should not be propagated to the view.
        
      
        

          1
          
              PROTECTED_IVARS = AbstractController::Rendering::DEFAULT_PROTECTED_INSTANCE_VARIABLES + [
        
      
        

          
          
                :@_status, :@_headers, :@_params, :@_env, :@_response, :@_request,
        
      
        

          
          
                :@_view_runtime, :@_stream, :@_url_options, :@_action_has_layout ]
        
      
        

          
          
          
        
      
        

          1
          
              def _protected_ivars # :nodoc:
        
      
        

          25
          
                PROTECTED_IVARS
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def self.protected_instance_variables
        
      
        

          
          
                PROTECTED_IVARS
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              ActiveSupport.run_load_hooks(:action_controller, self)
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'fileutils'
        
      
        

          1
          
          require 'uri'
        
      
        

          1
          
          require 'set'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # \Caching is a cheap way of speeding up slow applications by keeping the result of
        
      
        

          
          
            # calculations, renderings, and database calls around for subsequent requests.
        
      
        

          
          
            #
        
      
        

          
          
            # You can read more about each approach by clicking the modules below.
        
      
        

          
          
            #
        
      
        

          
          
            # Note: To turn off all caching, set
        
      
        

          
          
            #   config.action_controller.perform_caching = false
        
      
        

          
          
            #
        
      
        

          
          
            # == \Caching stores
        
      
        

          
          
            #
        
      
        

          
          
            # All the caching stores from ActiveSupport::Cache are available to be used as backends
        
      
        

          
          
            # for Action Controller caching.
        
      
        

          
          
            #
        
      
        

          
          
            # Configuration examples (FileStore is the default):
        
      
        

          
          
            #
        
      
        

          
          
            #   config.action_controller.cache_store = :memory_store
        
      
        

          
          
            #   config.action_controller.cache_store = :file_store, '/path/to/cache/directory'
        
      
        

          
          
            #   config.action_controller.cache_store = :mem_cache_store, 'localhost'
        
      
        

          
          
            #   config.action_controller.cache_store = :mem_cache_store, Memcached::Rails.new('localhost:11211')
        
      
        

          
          
            #   config.action_controller.cache_store = MyOwnStore.new('parameter')
        
      
        

          1
          
            module Caching
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          1
          
              extend ActiveSupport::Autoload
        
      
        

          
          
          
        
      
        

          1
          
              eager_autoload do
        
      
        

          1
          
                autoload :Fragments
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              module ConfigMethods
        
      
        

          1
          
                def cache_store
        
      
        

          
          
                  config.cache_store
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def cache_store=(store)
        
      
        

          1
          
                  config.cache_store = ActiveSupport::Cache.lookup_store(store)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                private
        
      
        

          1
          
                  def cache_configured?
        
      
        

          
          
                    perform_caching && cache_store
        
      
        

          
          
                  end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              include RackDelegation
        
      
        

          1
          
              include AbstractController::Callbacks
        
      
        

          
          
          
        
      
        

          1
          
              include ConfigMethods
        
      
        

          1
          
              include Fragments
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                extend ConfigMethods
        
      
        

          
          
          
        
      
        

          1
          
                config_accessor :default_static_extension
        
      
        

          1
          
                self.default_static_extension ||= '.html'
        
      
        

          
          
          
        
      
        

          1
          
                config_accessor :perform_caching
        
      
        

          1
          
                self.perform_caching = true if perform_caching.nil?
        
      
        

          
          
          
        
      
        

          1
          
                class_attribute :_view_cache_dependencies
        
      
        

          1
          
                self._view_cache_dependencies = []
        
      
        

          1
          
                helper_method :view_cache_dependencies if respond_to?(:helper_method)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              module ClassMethods
        
      
        

          1
          
                def view_cache_dependency(&dependency)
        
      
        

          
          
                  self._view_cache_dependencies += [dependency]
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def view_cache_dependencies
        
      
        

          
          
                self.class._view_cache_dependencies.map { |dep| instance_exec(&dep) }.compact
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              protected
        
      
        

          
          
                # Convenience accessor.
        
      
        

          1
          
                def cache(key, options = {}, &block)
        
      
        

          
          
                  if cache_configured?
        
      
        

          
          
                    cache_store.fetch(ActiveSupport::Cache.expand_cache_key(key, :controller), options, &block)
        
      
        

          
          
                  else
        
      
        

          
          
                    yield
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController
        
      
        

          1
          
            module Caching
        
      
        

          
          
              # Fragment caching is used for caching various blocks within
        
      
        

          
          
              # views without caching the entire action as a whole. This is
        
      
        

          
          
              # useful when certain elements of an action change frequently or
        
      
        

          
          
              # depend on complicated state while other parts rarely change or
        
      
        

          
          
              # can be shared amongst multiple parties. The caching is done using
        
      
        

          
          
              # the +cache+ helper available in the Action View. See
        
      
        

          
          
              # ActionView::Helpers::CacheHelper for more information.
        
      
        

          
          
              #
        
      
        

          
          
              # While it's strongly recommended that you use key-based cache
        
      
        

          
          
              # expiration (see links in CacheHelper for more information),
        
      
        

          
          
              # it is also possible to manually expire caches. For example:
        
      
        

          
          
              #
        
      
        

          
          
              #   expire_fragment('name_of_cache')
        
      
        

          1
          
              module Fragments
        
      
        

          
          
                # Given a key (as described in +expire_fragment+), returns
        
      
        

          
          
                # a key suitable for use in reading, writing, or expiring a
        
      
        

          
          
                # cached fragment. All keys are prefixed with <tt>views/</tt> and uses
        
      
        

          
          
                # ActiveSupport::Cache.expand_cache_key for the expansion.
        
      
        

          1
          
                def fragment_cache_key(key)
        
      
        

          
          
                  ActiveSupport::Cache.expand_cache_key(key.is_a?(Hash) ? url_for(key).split("://").last : key, :views)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Writes +content+ to the location signified by
        
      
        

          
          
                # +key+ (see +expire_fragment+ for acceptable formats).
        
      
        

          1
          
                def write_fragment(key, content, options = nil)
        
      
        

          
          
                  return content unless cache_configured?
        
      
        

          
          
          
        
      
        

          
          
                  key = fragment_cache_key(key)
        
      
        

          
          
                  instrument_fragment_cache :write_fragment, key do
        
      
        

          
          
                    content = content.to_str
        
      
        

          
          
                    cache_store.write(key, content, options)
        
      
        

          
          
                  end
        
      
        

          
          
                  content
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Reads a cached fragment from the location signified by +key+
        
      
        

          
          
                # (see +expire_fragment+ for acceptable formats).
        
      
        

          1
          
                def read_fragment(key, options = nil)
        
      
        

          
          
                  return unless cache_configured?
        
      
        

          
          
          
        
      
        

          
          
                  key = fragment_cache_key(key)
        
      
        

          
          
                  instrument_fragment_cache :read_fragment, key do
        
      
        

          
          
                    result = cache_store.read(key, options)
        
      
        

          
          
                    result.respond_to?(:html_safe) ? result.html_safe : result
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Check if a cached fragment from the location signified by
        
      
        

          
          
                # +key+ exists (see +expire_fragment+ for acceptable formats).
        
      
        

          1
          
                def fragment_exist?(key, options = nil)
        
      
        

          
          
                  return unless cache_configured?
        
      
        

          
          
                  key = fragment_cache_key(key)
        
      
        

          
          
          
        
      
        

          
          
                  instrument_fragment_cache :exist_fragment?, key do
        
      
        

          
          
                    cache_store.exist?(key, options)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Removes fragments from the cache.
        
      
        

          
          
                #
        
      
        

          
          
                # +key+ can take one of three forms:
        
      
        

          
          
                #
        
      
        

          
          
                # * String - This would normally take the form of a path, like
        
      
        

          
          
                #   <tt>pages/45/notes</tt>.
        
      
        

          
          
                # * Hash - Treated as an implicit call to +url_for+, like
        
      
        

          
          
                #   <tt>{ controller: 'pages', action: 'notes', id: 45}</tt>
        
      
        

          
          
                # * Regexp - Will remove any fragment that matches, so
        
      
        

          
          
                #   <tt>%r{pages/\d*/notes}</tt> might remove all notes. Make sure you
        
      
        

          
          
                #   don't use anchors in the regex (<tt>^</tt> or <tt>$</tt>) because
        
      
        

          
          
                #   the actual filename matched looks like
        
      
        

          
          
                #   <tt>./cache/filename/path.cache</tt>. Note: Regexp expiration is
        
      
        

          
          
                #   only supported on caches that can iterate over all keys (unlike
        
      
        

          
          
                #   memcached).
        
      
        

          
          
                #
        
      
        

          
          
                # +options+ is passed through to the cache store's +delete+
        
      
        

          
          
                # method (or <tt>delete_matched</tt>, for Regexp keys).
        
      
        

          1
          
                def expire_fragment(key, options = nil)
        
      
        

          
          
                  return unless cache_configured?
        
      
        

          
          
                  key = fragment_cache_key(key) unless key.is_a?(Regexp)
        
      
        

          
          
          
        
      
        

          
          
                  instrument_fragment_cache :expire_fragment, key do
        
      
        

          
          
                    if key.is_a?(Regexp)
        
      
        

          
          
                      cache_store.delete_matched(key, options)
        
      
        

          
          
                    else
        
      
        

          
          
                      cache_store.delete(key, options)
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def instrument_fragment_cache(name, key) # :nodoc:
        
      
        

          
          
                  payload = {
        
      
        

          
          
                    controller: controller_name,
        
      
        

          
          
                    action: action_name,
        
      
        

          
          
                    key: key
        
      
        

          
          
                  }
        
      
        

          
          
          
        
      
        

          
          
                  ActiveSupport::Notifications.instrument("#{name}.action_controller", payload) { yield }
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController
        
      
        

          1
          
            class LogSubscriber < ActiveSupport::LogSubscriber
        
      
        

          1
          
              INTERNAL_PARAMS = %w(controller action format _method only_path)
        
      
        

          
          
          
        
      
        

          1
          
              def start_processing(event)
        
      
        

          16
          
                return unless logger.info?
        
      
        

          
          
          
        
      
        

          16
          
                payload = event.payload
        
      
        

          16
          
                params  = payload[:params].except(*INTERNAL_PARAMS)
        
      
        

          16
          
                format  = payload[:format]
        
      
        

          16
          
                format  = format.to_s.upcase if format.is_a?(Symbol)
        
      
        

          
          
          
        
      
        

          16
          
                info "Processing by #{payload[:controller]}##{payload[:action]} as #{format}"
        
      
        

          16
          
                info "  Parameters: #{params.inspect}" unless params.empty?
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def process_action(event)
        
      
        

          16
          
                info do
        
      
        

          16
          
                  payload   = event.payload
        
      
        

          16
          
                  additions = ActionController::Base.log_process_action(payload)
        
      
        

          
          
          
        
      
        

          16
          
                  status = payload[:status]
        
      
        

          16
          
                  if status.nil? && payload[:exception].present?
        
      
        

          
          
                    exception_class_name = payload[:exception].first
        
      
        

          
          
                    status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception_class_name)
        
      
        

          
          
                  end
        
      
        

          16
          
                  message = "Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms"
        
      
        

          16
          
                  message << " (#{additions.join(" | ")})" unless additions.blank?
        
      
        

          16
          
                  message
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def halted_callback(event)
        
      
        

          
          
                info { "Filter chain halted as #{event.payload[:filter].inspect} rendered or redirected" }
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def send_file(event)
        
      
        

          
          
                info { "Sent file #{event.payload[:path]} (#{event.duration.round(1)}ms)" }
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def redirect_to(event)
        
      
        

          14
          
                info { "Redirected to #{event.payload[:location]}" }
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def send_data(event)
        
      
        

          
          
                info { "Sent data #{event.payload[:filename]} (#{event.duration.round(1)}ms)" }
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def unpermitted_parameters(event)
        
      
        

          1
          
                debug do
        
      
        

          1
          
                  unpermitted_keys = event.payload[:keys]
        
      
        

          1
          
                  "Unpermitted parameter#{'s' if unpermitted_keys.size > 1}: #{unpermitted_keys.join(", ")}"
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def deep_munge(event)
        
      
        

          
          
                debug do
        
      
        

          
          
                  "Value for params[:#{event.payload[:keys].join('][:')}] was set "\
        
      
        

          
          
                  "to nil, because it was one of [], [null] or [null, null, ...]. "\
        
      
        

          
          
                  "Go to http://guides.rubyonrails.org/security.html#unsafe-query-generation "\
        
      
        

          
          
                  "for more information."\
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              %w(write_fragment read_fragment exist_fragment?
        
      
        

          1
          
                 expire_fragment expire_page write_page).each do |method|
        
      
        

          6
          
                class_eval <<-METHOD, __FILE__, __LINE__ + 1
        
      
        

          
          
                  def #{method}(event)
        
      
        

          
          
                    return unless logger.info?
        
      
        

          
          
                    key_or_path = event.payload[:key] || event.payload[:path]
        
      
        

          
          
                    human_name  = #{method.to_s.humanize.inspect}
        
      
        

          
          
                    info("\#{human_name} \#{key_or_path} (\#{event.duration.round(1)}ms)")
        
      
        

          
          
                  end
        
      
        

          
          
                METHOD
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def logger
        
      
        

          206
          
                ActionController::Base.logger
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
        

          
          
          
        
      
        

          1
          
          ActionController::LogSubscriber.attach_to :action_controller
        
      
    
  

    

      
        

          1
          
          require 'active_support/core_ext/array/extract_options'
        
      
        

          1
          
          require 'action_dispatch/middleware/stack'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # Extend ActionDispatch middleware stack to make it aware of options
        
      
        

          
          
            # allowing the following syntax in controllers:
        
      
        

          
          
            #
        
      
        

          
          
            #   class PostsController < ApplicationController
        
      
        

          
          
            #     use AuthenticationMiddleware, except: [:index, :show]
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          1
          
            class MiddlewareStack < ActionDispatch::MiddlewareStack #:nodoc:
        
      
        

          1
          
              class Middleware < ActionDispatch::MiddlewareStack::Middleware #:nodoc:
        
      
        

          1
          
                def initialize(klass, *args, &block)
        
      
        

          
          
                  options = args.extract_options!
        
      
        

          
          
                  @only   = Array(options.delete(:only)).map(&:to_s)
        
      
        

          
          
                  @except = Array(options.delete(:except)).map(&:to_s)
        
      
        

          
          
                  args << options unless options.empty?
        
      
        

          
          
                  super
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def valid?(action)
        
      
        

          
          
                  if @only.present?
        
      
        

          
          
                    @only.include?(action)
        
      
        

          
          
                  elsif @except.present?
        
      
        

          
          
                    !@except.include?(action)
        
      
        

          
          
                  else
        
      
        

          
          
                    true
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def build(action, app = Proc.new)
        
      
        

          
          
                action = action.to_s
        
      
        

          
          
          
        
      
        

          
          
                middlewares.reverse.inject(app) do |a, middleware|
        
      
        

          
          
                  middleware.valid?(action) ? middleware.build(a) : a
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # <tt>ActionController::Metal</tt> is the simplest possible controller, providing a
        
      
        

          
          
            # valid Rack interface without the additional niceties provided by
        
      
        

          
          
            # <tt>ActionController::Base</tt>.
        
      
        

          
          
            #
        
      
        

          
          
            # A sample metal controller might look like this:
        
      
        

          
          
            #
        
      
        

          
          
            #   class HelloController < ActionController::Metal
        
      
        

          
          
            #     def index
        
      
        

          
          
            #       self.response_body = "Hello World!"
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # And then to route requests to your metal controller, you would add
        
      
        

          
          
            # something like this to <tt>config/routes.rb</tt>:
        
      
        

          
          
            #
        
      
        

          
          
            #   get 'hello', to: HelloController.action(:index)
        
      
        

          
          
            #
        
      
        

          
          
            # The +action+ method returns a valid Rack application for the \Rails
        
      
        

          
          
            # router to dispatch to.
        
      
        

          
          
            #
        
      
        

          
          
            # == Rendering Helpers
        
      
        

          
          
            #
        
      
        

          
          
            # <tt>ActionController::Metal</tt> by default provides no utilities for rendering
        
      
        

          
          
            # views, partials, or other responses aside from explicitly calling of
        
      
        

          
          
            # <tt>response_body=</tt>, <tt>content_type=</tt>, and <tt>status=</tt>. To
        
      
        

          
          
            # add the render helpers you're used to having in a normal controller, you
        
      
        

          
          
            # can do the following:
        
      
        

          
          
            #
        
      
        

          
          
            #   class HelloController < ActionController::Metal
        
      
        

          
          
            #     include AbstractController::Rendering
        
      
        

          
          
            #     include ActionView::Layouts
        
      
        

          
          
            #     append_view_path "#{Rails.root}/app/views"
        
      
        

          
          
            #
        
      
        

          
          
            #     def index
        
      
        

          
          
            #       render "hello/index"
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # == Redirection Helpers
        
      
        

          
          
            #
        
      
        

          
          
            # To add redirection helpers to your metal controller, do the following:
        
      
        

          
          
            #
        
      
        

          
          
            #   class HelloController < ActionController::Metal
        
      
        

          
          
            #     include ActionController::Redirecting
        
      
        

          
          
            #     include Rails.application.routes.url_helpers
        
      
        

          
          
            #
        
      
        

          
          
            #     def index
        
      
        

          
          
            #       redirect_to root_url
        
      
        

          
          
            #     end
        
      
        

          
          
            #   end
        
      
        

          
          
            #
        
      
        

          
          
            # == Other Helpers
        
      
        

          
          
            #
        
      
        

          
          
            # You can refer to the modules included in <tt>ActionController::Base</tt> to see
        
      
        

          
          
            # other features you can bring into your metal controller.
        
      
        

          
          
            #
        
      
        

          1
          
            class Metal < AbstractController::Base
        
      
        

          1
          
              abstract!
        
      
        

          
          
          
        
      
        

          1
          
              attr_internal_writer :env
        
      
        

          
          
          
        
      
        

          1
          
              def env
        
      
        

          84
          
                @_env ||= {}
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Returns the last part of the controller's name, underscored, without the ending
        
      
        

          
          
              # <tt>Controller</tt>. For instance, PostsController returns <tt>posts</tt>.
        
      
        

          
          
              # Namespaces are left out, so Admin::PostsController returns <tt>posts</tt> as well.
        
      
        

          
          
              #
        
      
        

          
          
              # ==== Returns
        
      
        

          
          
              # * <tt>string</tt>
        
      
        

          1
          
              def self.controller_name
        
      
        

          
          
                @controller_name ||= name.demodulize.sub(/Controller$/, '').underscore
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Delegates to the class' <tt>controller_name</tt>
        
      
        

          1
          
              def controller_name
        
      
        

          
          
                self.class.controller_name
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # The details below can be overridden to support a specific
        
      
        

          
          
              # Request and Response object. The default ActionController::Base
        
      
        

          
          
              # implementation includes RackDelegation, which makes a request
        
      
        

          
          
              # and response object available. You might wish to control the
        
      
        

          
          
              # environment and response manually for performance reasons.
        
      
        

          
          
          
        
      
        

          1
          
              attr_internal :headers, :response, :request
        
      
        

          1
          
              delegate :session, :to => "@_request"
        
      
        

          
          
          
        
      
        

          1
          
              def initialize
        
      
        

          18
          
                @_headers = {"Content-Type" => "text/html"}
        
      
        

          18
          
                @_status = 200
        
      
        

          18
          
                @_request = nil
        
      
        

          18
          
                @_response = nil
        
      
        

          18
          
                @_routes = nil
        
      
        

          18
          
                super
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def params
        
      
        

          
          
                @_params ||= request.parameters
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def params=(val)
        
      
        

          
          
                @_params = val
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Basic implementations for content_type=, location=, and headers are
        
      
        

          
          
              # provided to reduce the dependency on the RackDelegation module
        
      
        

          
          
              # in Renderer and Redirector.
        
      
        

          
          
          
        
      
        

          1
          
              def content_type=(type)
        
      
        

          
          
                headers["Content-Type"] = type.to_s
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def content_type
        
      
        

          
          
                headers["Content-Type"]
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def location
        
      
        

          
          
                headers["Location"]
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def location=(url)
        
      
        

          
          
                headers["Location"] = url
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Basic url_for that can be overridden for more robust functionality
        
      
        

          1
          
              def url_for(string)
        
      
        

          
          
                string
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def status
        
      
        

          
          
                @_status
        
      
        

          
          
              end
        
      
        

          1
          
              alias :response_code :status # :nodoc:
        
      
        

          
          
          
        
      
        

          1
          
              def status=(status)
        
      
        

          
          
                @_status = Rack::Utils.status_code(status)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def response_body=(body)
        
      
        

          16
          
                body = [body] unless body.nil? || body.respond_to?(:each)
        
      
        

          16
          
                super
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Tests if render or redirect has already happened.
        
      
        

          1
          
              def performed?
        
      
        

          16
          
                response_body || (response && response.committed?)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def dispatch(name, request) #:nodoc:
        
      
        

          
          
                @_request = request
        
      
        

          
          
                @_env = request.env
        
      
        

          
          
                @_env['action_controller.instance'] = self
        
      
        

          
          
                process(name)
        
      
        

          
          
                to_a
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def to_a #:nodoc:
        
      
        

          
          
                response ? response.to_a : [status, headers, response_body]
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              class_attribute :middleware_stack
        
      
        

          1
          
              self.middleware_stack = ActionController::MiddlewareStack.new
        
      
        

          
          
          
        
      
        

          1
          
              def self.inherited(base) # :nodoc:
        
      
        

          6
          
                base.middleware_stack = middleware_stack.dup
        
      
        

          6
          
                super
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Pushes the given Rack middleware and its arguments to the bottom of the
        
      
        

          
          
              # middleware stack.
        
      
        

          1
          
              def self.use(*args, &block)
        
      
        

          
          
                middleware_stack.use(*args, &block)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Alias for +middleware_stack+.
        
      
        

          1
          
              def self.middleware
        
      
        

          
          
                middleware_stack
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Makes the controller a Rack endpoint that runs the action in the given
        
      
        

          
          
              # +env+'s +action_dispatch.request.path_parameters+ key.
        
      
        

          1
          
              def self.call(env)
        
      
        

          
          
                req = ActionDispatch::Request.new env
        
      
        

          
          
                action(req.path_parameters[:action]).call(env)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Returns a Rack endpoint for the given action name.
        
      
        

          1
          
              def self.action(name, klass = ActionDispatch::Request)
        
      
        

          
          
                if middleware_stack.any?
        
      
        

          
          
                  middleware_stack.build(name) do |env|
        
      
        

          
          
                    new.dispatch(name, klass.new(env))
        
      
        

          
          
                  end
        
      
        

          
          
                else
        
      
        

          
          
                  lambda { |env| new.dispatch(name, klass.new(env)) }
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'active_support/core_ext/hash/keys'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          1
          
            module ConditionalGet
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              include RackDelegation
        
      
        

          1
          
              include Head
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                class_attribute :etaggers
        
      
        

          1
          
                self.etaggers = []
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              module ClassMethods
        
      
        

          
          
                # Allows you to consider additional controller-wide information when generating an ETag.
        
      
        

          
          
                # For example, if you serve pages tailored depending on who's logged in at the moment, you
        
      
        

          
          
                # may want to add the current user id to be part of the ETag to prevent authorized displaying
        
      
        

          
          
                # of cached pages.
        
      
        

          
          
                #
        
      
        

          
          
                #   class InvoicesController < ApplicationController
        
      
        

          
          
                #     etag { current_user.try :id }
        
      
        

          
          
                #
        
      
        

          
          
                #     def show
        
      
        

          
          
                #       # Etag will differ even for the same invoice when it's viewed by a different current_user
        
      
        

          
          
                #       @invoice = Invoice.find(params[:id])
        
      
        

          
          
                #       fresh_when(@invoice)
        
      
        

          
          
                #     end
        
      
        

          
          
                #   end
        
      
        

          1
          
                def etag(&etagger)
        
      
        

          1
          
                  self.etaggers += [etagger]
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Sets the +etag+, +last_modified+, or both on the response and renders a
        
      
        

          
          
              # <tt>304 Not Modified</tt> response if the request is already fresh.
        
      
        

          
          
              #
        
      
        

          
          
              # === Parameters:
        
      
        

          
          
              #
        
      
        

          
          
              # * <tt>:etag</tt>.
        
      
        

          
          
              # * <tt>:last_modified</tt>.
        
      
        

          
          
              # * <tt>:public</tt> By default the Cache-Control header is private, set this to
        
      
        

          
          
              #   +true+ if you want your application to be cachable by other devices (proxy caches).
        
      
        

          
          
              # * <tt>:template</tt> By default, the template digest for the current
        
      
        

          
          
              #   controller/action is included in ETags. If the action renders a
        
      
        

          
          
              #   different template, you can include its digest instead. If the action
        
      
        

          
          
              #   doesn't render a template at all, you can pass <tt>template: false</tt>
        
      
        

          
          
              #   to skip any attempt to check for a template digest.
        
      
        

          
          
              #
        
      
        

          
          
              # === Example:
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #     fresh_when(etag: @article, last_modified: @article.created_at, public: true)
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # This will render the show template if the request isn't sending a matching ETag or
        
      
        

          
          
              # If-Modified-Since header and just a <tt>304 Not Modified</tt> response if there's a match.
        
      
        

          
          
              #
        
      
        

          
          
              # You can also just pass a record where +last_modified+ will be set by calling
        
      
        

          
          
              # +updated_at+ and the +etag+ by passing the object itself.
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #     fresh_when(@article)
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # When passing a record, you can still set whether the public header:
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #     fresh_when(@article, public: true)
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # When rendering a different template than the default controller/action
        
      
        

          
          
              # style, you can indicate which digest to include in the ETag:
        
      
        

          
          
              #
        
      
        

          
          
              #   before_action { fresh_when @article, template: 'widgets/show' }
        
      
        

          
          
              #
        
      
        

          1
          
              def fresh_when(record_or_options, additional_options = {})
        
      
        

          
          
                if record_or_options.is_a? Hash
        
      
        

          
          
                  options = record_or_options
        
      
        

          
          
                  options.assert_valid_keys(:etag, :last_modified, :public, :template)
        
      
        

          
          
                else
        
      
        

          
          
                  record  = record_or_options
        
      
        

          
          
                  options = { etag: record, last_modified: record.try(:updated_at) }.merge!(additional_options)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                response.etag          = combine_etags(options)   if options[:etag] || options[:template]
        
      
        

          
          
                response.last_modified = options[:last_modified]  if options[:last_modified]
        
      
        

          
          
                response.cache_control[:public] = true            if options[:public]
        
      
        

          
          
          
        
      
        

          
          
                head :not_modified if request.fresh?(response)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Sets the +etag+ and/or +last_modified+ on the response and checks it against
        
      
        

          
          
              # the client request. If the request doesn't match the options provided, the
        
      
        

          
          
              # request is considered stale and should be generated from scratch. Otherwise,
        
      
        

          
          
              # it's fresh and we don't need to generate anything and a reply of <tt>304 Not Modified</tt> is sent.
        
      
        

          
          
              #
        
      
        

          
          
              # === Parameters:
        
      
        

          
          
              #
        
      
        

          
          
              # * <tt>:etag</tt>.
        
      
        

          
          
              # * <tt>:last_modified</tt>.
        
      
        

          
          
              # * <tt>:public</tt> By default the Cache-Control header is private, set this to
        
      
        

          
          
              #   +true+ if you want your application to be cachable by other devices (proxy caches).
        
      
        

          
          
              # * <tt>:template</tt> By default, the template digest for the current
        
      
        

          
          
              #   controller/action is included in ETags. If the action renders a
        
      
        

          
          
              #   different template, you can include its digest instead. If the action
        
      
        

          
          
              #   doesn't render a template at all, you can pass <tt>template: false</tt>
        
      
        

          
          
              #   to skip any attempt to check for a template digest.
        
      
        

          
          
              #
        
      
        

          
          
              # === Example:
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #
        
      
        

          
          
              #     if stale?(etag: @article, last_modified: @article.created_at)
        
      
        

          
          
              #       @statistics = @article.really_expensive_call
        
      
        

          
          
              #       respond_to do |format|
        
      
        

          
          
              #         # all the supported formats
        
      
        

          
          
              #       end
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # You can also just pass a record where +last_modified+ will be set by calling
        
      
        

          
          
              # +updated_at+ and the +etag+ by passing the object itself.
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #
        
      
        

          
          
              #     if stale?(@article)
        
      
        

          
          
              #       @statistics = @article.really_expensive_call
        
      
        

          
          
              #       respond_to do |format|
        
      
        

          
          
              #         # all the supported formats
        
      
        

          
          
              #       end
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # When passing a record, you can still set whether the public header:
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     @article = Article.find(params[:id])
        
      
        

          
          
              #
        
      
        

          
          
              #     if stale?(@article, public: true)
        
      
        

          
          
              #       @statistics = @article.really_expensive_call
        
      
        

          
          
              #       respond_to do |format|
        
      
        

          
          
              #         # all the supported formats
        
      
        

          
          
              #       end
        
      
        

          
          
              #     end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # When rendering a different template than the default controller/action
        
      
        

          
          
              # style, you can indicate which digest to include in the ETag:
        
      
        

          
          
              #
        
      
        

          
          
              #   def show
        
      
        

          
          
              #     super if stale? @article, template: 'widgets/show'
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          1
          
              def stale?(record_or_options, additional_options = {})
        
      
        

          
          
                fresh_when(record_or_options, additional_options)
        
      
        

          
          
                !request.fresh?(response)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Sets a HTTP 1.1 Cache-Control header. Defaults to issuing a +private+
        
      
        

          
          
              # instruction, so that intermediate caches must not cache the response.
        
      
        

          
          
              #
        
      
        

          
          
              #   expires_in 20.minutes
        
      
        

          
          
              #   expires_in 3.hours, public: true
        
      
        

          
          
              #   expires_in 3.hours, public: true, must_revalidate: true
        
      
        

          
          
              #
        
      
        

          
          
              # This method will overwrite an existing Cache-Control header.
        
      
        

          
          
              # See http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html for more possibilities.
        
      
        

          
          
              #
        
      
        

          
          
              # The method will also ensure a HTTP Date header for client compatibility.
        
      
        

          1
          
              def expires_in(seconds, options = {})
        
      
        

          
          
                response.cache_control.merge!(
        
      
        

          
          
                  :max_age         => seconds,
        
      
        

          
          
                  :public          => options.delete(:public),
        
      
        

          
          
                  :must_revalidate => options.delete(:must_revalidate)
        
      
        

          
          
                )
        
      
        

          
          
                options.delete(:private)
        
      
        

          
          
          
        
      
        

          
          
                response.cache_control[:extras] = options.map {|k,v| "#{k}=#{v}"}
        
      
        

          
          
                response.date = Time.now unless response.date?
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Sets a HTTP 1.1 Cache-Control header of <tt>no-cache</tt> so no caching should
        
      
        

          
          
              # occur by the browser or intermediate caches (like caching proxy servers).
        
      
        

          1
          
              def expires_now
        
      
        

          
          
                response.cache_control.replace(:no_cache => true)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              private
        
      
        

          1
          
                def combine_etags(options)
        
      
        

          
          
                  etags = etaggers.map { |etagger| instance_exec(options, &etagger) }.compact
        
      
        

          
          
                  etags.unshift options[:etag]
        
      
        

          
          
                end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController #:nodoc:
        
      
        

          1
          
            module Cookies
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              include RackDelegation
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                helper_method :cookies
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              private
        
      
        

          1
          
                def cookies
        
      
        

          16
          
                  request.cookie_jar
        
      
        

          
          
                end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'action_controller/metal/exceptions'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController #:nodoc:
        
      
        

          
          
            # Methods for sending arbitrary data and for streaming files to the browser,
        
      
        

          
          
            # instead of rendering.
        
      
        

          1
          
            module DataStreaming
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              include ActionController::Rendering
        
      
        

          
          
          
        
      
        

          1
          
              DEFAULT_SEND_FILE_TYPE        = 'application/octet-stream'.freeze #:nodoc:
        
      
        

          1
          
              DEFAULT_SEND_FILE_DISPOSITION = 'attachment'.freeze #:nodoc:
        
      
        

          
          
          
        
      
        

          1
          
              protected
        
      
        

          
          
                # Sends the file. This uses a server-appropriate method (such as X-Sendfile)
        
      
        

          
          
                # via the Rack::Sendfile middleware. The header to use is set via
        
      
        

          
          
                # +config.action_dispatch.x_sendfile_header+.
        
      
        

          
          
                # Your server can also configure this for you by setting the X-Sendfile-Type header.
        
      
        

          
          
                #
        
      
        

          
          
                # Be careful to sanitize the path parameter if it is coming from a web
        
      
        

          
          
                # page. <tt>send_file(params[:path])</tt> allows a malicious user to
        
      
        

          
          
                # download any file on your server.
        
      
        

          
          
                #
        
      
        

          
          
                # Options:
        
      
        

          
          
                # * <tt>:filename</tt> - suggests a filename for the browser to use.
        
      
        

          
          
                #   Defaults to <tt>File.basename(path)</tt>.
        
      
        

          
          
                # * <tt>:type</tt> - specifies an HTTP content type.
        
      
        

          
          
                #   You can specify either a string or a symbol for a registered type register with
        
      
        

          
          
                #   <tt>Mime::Type.register</tt>, for example :json
        
      
        

          
          
                #   If omitted, type will be guessed from the file extension specified in <tt>:filename</tt>.
        
      
        

          
          
                #   If no content type is registered for the extension, default type 'application/octet-stream' will be used.
        
      
        

          
          
                # * <tt>:disposition</tt> - specifies whether the file will be shown inline or downloaded.
        
      
        

          
          
                #   Valid values are 'inline' and 'attachment' (default).
        
      
        

          
          
                # * <tt>:status</tt> - specifies the status code to send with the response. Defaults to 200.
        
      
        

          
          
                # * <tt>:url_based_filename</tt> - set to +true+ if you want the browser guess the filename from
        
      
        

          
          
                #   the URL, which is necessary for i18n filenames on certain browsers
        
      
        

          
          
                #   (setting <tt>:filename</tt> overrides this option).
        
      
        

          
          
                #
        
      
        

          
          
                # The default Content-Type and Content-Disposition headers are
        
      
        

          
          
                # set to download arbitrary binary files in as many browsers as
        
      
        

          
          
                # possible. IE versions 4, 5, 5.5, and 6 are all known to have
        
      
        

          
          
                # a variety of quirks (especially when downloading over SSL).
        
      
        

          
          
                #
        
      
        

          
          
                # Simple download:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_file '/path/to.zip'
        
      
        

          
          
                #
        
      
        

          
          
                # Show a JPEG in the browser:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_file '/path/to.jpeg', type: 'image/jpeg', disposition: 'inline'
        
      
        

          
          
                #
        
      
        

          
          
                # Show a 404 page in the browser:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_file '/path/to/404.html', type: 'text/html; charset=utf-8', status: 404
        
      
        

          
          
                #
        
      
        

          
          
                # Read about the other Content-* HTTP headers if you'd like to
        
      
        

          
          
                # provide the user with more information (such as Content-Description) in
        
      
        

          
          
                # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11.
        
      
        

          
          
                #
        
      
        

          
          
                # Also be aware that the document may be cached by proxies and browsers.
        
      
        

          
          
                # The Pragma and Cache-Control headers declare how the file may be cached
        
      
        

          
          
                # by intermediaries. They default to require clients to validate with
        
      
        

          
          
                # the server before releasing cached responses. See
        
      
        

          
          
                # http://www.mnot.net/cache_docs/ for an overview of web caching and
        
      
        

          
          
                # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9
        
      
        

          
          
                # for the Cache-Control header spec.
        
      
        

          1
          
                def send_file(path, options = {}) #:doc:
        
      
        

          
          
                  raise MissingFile, "Cannot read file #{path}" unless File.file?(path) and File.readable?(path)
        
      
        

          
          
          
        
      
        

          
          
                  options[:filename] ||= File.basename(path) unless options[:url_based_filename]
        
      
        

          
          
                  send_file_headers! options
        
      
        

          
          
          
        
      
        

          
          
                  self.status = options[:status] || 200
        
      
        

          
          
                  self.content_type = options[:content_type] if options.key?(:content_type)
        
      
        

          
          
                  self.response_body = FileBody.new(path)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Avoid having to pass an open file handle as the response body.
        
      
        

          
          
                # Rack::Sendfile will usually intercept the response and uses
        
      
        

          
          
                # the path directly, so there is no reason to open the file.
        
      
        

          1
          
                class FileBody #:nodoc:
        
      
        

          1
          
                  attr_reader :to_path
        
      
        

          
          
          
        
      
        

          1
          
                  def initialize(path)
        
      
        

          
          
                    @to_path = path
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  # Stream the file's contents if Rack::Sendfile isn't present.
        
      
        

          1
          
                  def each
        
      
        

          
          
                    File.open(to_path, 'rb') do |file|
        
      
        

          
          
                      while chunk = file.read(16384)
        
      
        

          
          
                        yield chunk
        
      
        

          
          
                      end
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Sends the given binary data to the browser. This method is similar to
        
      
        

          
          
                # <tt>render plain: data</tt>, but also allows you to specify whether
        
      
        

          
          
                # the browser should display the response as a file attachment (i.e. in a
        
      
        

          
          
                # download dialog) or as inline data. You may also set the content type,
        
      
        

          
          
                # the apparent file name, and other things.
        
      
        

          
          
                #
        
      
        

          
          
                # Options:
        
      
        

          
          
                # * <tt>:filename</tt> - suggests a filename for the browser to use.
        
      
        

          
          
                # * <tt>:type</tt> - specifies an HTTP content type. Defaults to 'application/octet-stream'. You can specify
        
      
        

          
          
                #   either a string or a symbol for a registered type register with <tt>Mime::Type.register</tt>, for example :json
        
      
        

          
          
                #   If omitted, type will be guessed from the file extension specified in <tt>:filename</tt>.
        
      
        

          
          
                #   If no content type is registered for the extension, default type 'application/octet-stream' will be used.
        
      
        

          
          
                # * <tt>:disposition</tt> - specifies whether the file will be shown inline or downloaded.
        
      
        

          
          
                #   Valid values are 'inline' and 'attachment' (default).
        
      
        

          
          
                # * <tt>:status</tt> - specifies the status code to send with the response. Defaults to 200.
        
      
        

          
          
                #
        
      
        

          
          
                # Generic data download:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_data buffer
        
      
        

          
          
                #
        
      
        

          
          
                # Download a dynamically-generated tarball:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_data generate_tgz('dir'), filename: 'dir.tgz'
        
      
        

          
          
                #
        
      
        

          
          
                # Display an image Active Record in the browser:
        
      
        

          
          
                #
        
      
        

          
          
                #   send_data image.data, type: image.content_type, disposition: 'inline'
        
      
        

          
          
                #
        
      
        

          
          
                # See +send_file+ for more information on HTTP Content-* headers and caching.
        
      
        

          1
          
                def send_data(data, options = {}) #:doc:
        
      
        

          
          
                  send_file_headers! options
        
      
        

          
          
                  render options.slice(:status, :content_type).merge(:text => data)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
              private
        
      
        

          1
          
                def send_file_headers!(options)
        
      
        

          
          
                  type_provided = options.has_key?(:type)
        
      
        

          
          
          
        
      
        

          
          
                  content_type = options.fetch(:type, DEFAULT_SEND_FILE_TYPE)
        
      
        

          
          
                  raise ArgumentError, ":type option required" if content_type.nil?
        
      
        

          
          
          
        
      
        

          
          
                  if content_type.is_a?(Symbol)
        
      
        

          
          
                    extension = Mime[content_type]
        
      
        

          
          
                    raise ArgumentError, "Unknown MIME type #{options[:type]}" unless extension
        
      
        

          
          
                    self.content_type = extension
        
      
        

          
          
                  else
        
      
        

          
          
                    if !type_provided && options[:filename]
        
      
        

          
          
                      # If type wasn't provided, try guessing from file extension.
        
      
        

          
          
                      content_type = Mime::Type.lookup_by_extension(File.extname(options[:filename]).downcase.delete('.')) || content_type
        
      
        

          
          
                    end
        
      
        

          
          
                    self.content_type = content_type
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  disposition = options.fetch(:disposition, DEFAULT_SEND_FILE_DISPOSITION)
        
      
        

          
          
                  unless disposition.nil?
        
      
        

          
          
                    disposition  = disposition.to_s
        
      
        

          
          
                    disposition += %(; filename="#{options[:filename]}") if options[:filename]
        
      
        

          
          
                    headers['Content-Disposition'] = disposition
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  headers['Content-Transfer-Encoding'] = 'binary'
        
      
        

          
          
          
        
      
        

          
          
                  response.sending_file = true
        
      
        

          
          
          
        
      
        

          
          
                  # Fix a problem with IE 6.0 on opening downloaded files:
        
      
        

          
          
                  # If Cache-Control: no-cache is set (which Rails does by default),
        
      
        

          
          
                  # IE removes the file it just downloaded from its cache immediately
        
      
        

          
          
                  # after it displays the "open/save" dialog, which means that if you
        
      
        

          
          
                  # hit "open" the file isn't there anymore when the application that
        
      
        

          
          
                  # is called for handling the download is run, so let's workaround that
        
      
        

          
          
                  response.cache_control[:public] ||= false
        
      
        

          
          
                end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController
        
      
        

          
          
            # When our views change, they should bubble up into HTTP cache freshness
        
      
        

          
          
            # and bust browser caches. So the template digest for the current action
        
      
        

          
          
            # is automatically included in the ETag.
        
      
        

          
          
            #
        
      
        

          
          
            # Enabled by default for apps that use Action View. Disable by setting
        
      
        

          
          
            #
        
      
        

          
          
            #   config.action_controller.etag_with_template_digest = false
        
      
        

          
          
            #
        
      
        

          
          
            # Override the template to digest by passing +:template+ to +fresh_when+
        
      
        

          
          
            # and +stale?+ calls. For example:
        
      
        

          
          
            #
        
      
        

          
          
            #   # We're going to render widgets/show, not posts/show
        
      
        

          
          
            #   fresh_when @post, template: 'widgets/show'
        
      
        

          
          
            #
        
      
        

          
          
            #   # We're not going to render a template, so omit it from the ETag.
        
      
        

          
          
            #   fresh_when @post, template: false
        
      
        

          
          
            #
        
      
        

          1
          
            module EtagWithTemplateDigest
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              include ActionController::ConditionalGet
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                class_attribute :etag_with_template_digest
        
      
        

          1
          
                self.etag_with_template_digest = true
        
      
        

          
          
          
        
      
        

          1
          
                ActiveSupport.on_load :action_view, yield: true do |action_view_base|
        
      
        

          1
          
                  etag do |options|
        
      
        

          
          
                    determine_template_etag(options) if etag_with_template_digest
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              private
        
      
        

          1
          
              def determine_template_etag(options)
        
      
        

          
          
                if template = pick_template_for_etag(options)
        
      
        

          
          
                  lookup_and_digest_template(template)
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def pick_template_for_etag(options)
        
      
        

          
          
                options.fetch(:template) { "#{controller_name}/#{action_name}" }
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def lookup_and_digest_template(template)
        
      
        

          
          
                ActionView::Digestor.digest name: template, finder: lookup_context
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController #:nodoc:
        
      
        

          1
          
            module Flash
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                class_attribute :_flash_types, instance_accessor: false
        
      
        

          1
          
                self._flash_types = []
        
      
        

          
          
          
        
      
        

          1
          
                delegate :flash, to: :request
        
      
        

          1
          
                add_flash_types(:alert, :notice)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              module ClassMethods
        
      
        

          
          
                # Creates new flash types. You can pass as many types as you want to create
        
      
        

          
          
                # flash types other than the default <tt>alert</tt> and <tt>notice</tt> in
        
      
        

          
          
                # your controllers and views. For instance:
        
      
        

          
          
                #
        
      
        

          
          
                #   # in application_controller.rb
        
      
        

          
          
                #   class ApplicationController < ActionController::Base
        
      
        

          
          
                #     add_flash_types :warning
        
      
        

          
          
                #   end
        
      
        

          
          
                #
        
      
        

          
          
                #   # in your controller
        
      
        

          
          
                #   redirect_to user_path(@user), warning: "Incomplete profile"
        
      
        

          
          
                #
        
      
        

          
          
                #   # in your view
        
      
        

          
          
                #   <%= warning %>
        
      
        

          
          
                #
        
      
        

          
          
                # This method will automatically define a new method for each of the given
        
      
        

          
          
                # names, and it will be available in your views.
        
      
        

          1
          
                def add_flash_types(*types)
        
      
        

          1
          
                  types.each do |type|
        
      
        

          2
          
                    next if _flash_types.include?(type)
        
      
        

          
          
          
        
      
        

          2
          
                    define_method(type) do
        
      
        

          
          
                      request.flash[type]
        
      
        

          
          
                    end
        
      
        

          2
          
                    helper_method type
        
      
        

          
          
          
        
      
        

          2
          
                    self._flash_types += [type]
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              protected
        
      
        

          1
          
                def redirect_to(options = {}, response_status_and_flash = {}) #:doc:
        
      
        

          7
          
                  self.class._flash_types.each do |flash_type|
        
      
        

          14
          
                    if type = response_status_and_flash.delete(flash_type)
        
      
        

          3
          
                      flash[flash_type] = type
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          7
          
                  if other_flashes = response_status_and_flash.delete(:flash)
        
      
        

          
          
                    flash.update(other_flashes)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          7
          
                  super(options, response_status_and_flash)
        
      
        

          
          
                end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'active_support/core_ext/hash/except'
        
      
        

          1
          
          require 'active_support/core_ext/hash/slice'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # This module provides a method which will redirect browser to use HTTPS
        
      
        

          
          
            # protocol. This will ensure that user's sensitive information will be
        
      
        

          
          
            # transferred safely over the internet. You _should_ always force browser
        
      
        

          
          
            # to use HTTPS when you're transferring sensitive information such as
        
      
        

          
          
            # user authentication, account information, or credit card information.
        
      
        

          
          
            #
        
      
        

          
          
            # Note that if you are really concerned about your application security,
        
      
        

          
          
            # you might consider using +config.force_ssl+ in your config file instead.
        
      
        

          
          
            # That will ensure all the data transferred via HTTPS protocol and prevent
        
      
        

          
          
            # user from getting session hijacked when accessing the site under unsecured
        
      
        

          
          
            # HTTP protocol.
        
      
        

          1
          
            module ForceSSL
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          1
          
              include AbstractController::Callbacks
        
      
        

          
          
          
        
      
        

          1
          
              ACTION_OPTIONS = [:only, :except, :if, :unless]
        
      
        

          1
          
              URL_OPTIONS = [:protocol, :host, :domain, :subdomain, :port, :path]
        
      
        

          1
          
              REDIRECT_OPTIONS = [:status, :flash, :alert, :notice]
        
      
        

          
          
          
        
      
        

          1
          
              module ClassMethods
        
      
        

          
          
                # Force the request to this particular controller or specified actions to be
        
      
        

          
          
                # under HTTPS protocol.
        
      
        

          
          
                #
        
      
        

          
          
                # If you need to disable this for any reason (e.g. development) then you can use
        
      
        

          
          
                # an +:if+ or +:unless+ condition.
        
      
        

          
          
                #
        
      
        

          
          
                #     class AccountsController < ApplicationController
        
      
        

          
          
                #       force_ssl if: :ssl_configured?
        
      
        

          
          
                #
        
      
        

          
          
                #       def ssl_configured?
        
      
        

          
          
                #         !Rails.env.development?
        
      
        

          
          
                #       end
        
      
        

          
          
                #     end
        
      
        

          
          
                #
        
      
        

          
          
                # ==== URL Options
        
      
        

          
          
                # You can pass any of the following options to affect the redirect url
        
      
        

          
          
                # * <tt>host</tt>       - Redirect to a different host name
        
      
        

          
          
                # * <tt>subdomain</tt>  - Redirect to a different subdomain
        
      
        

          
          
                # * <tt>domain</tt>     - Redirect to a different domain
        
      
        

          
          
                # * <tt>port</tt>       - Redirect to a non-standard port
        
      
        

          
          
                # * <tt>path</tt>       - Redirect to a different path
        
      
        

          
          
                #
        
      
        

          
          
                # ==== Redirect Options
        
      
        

          
          
                # You can pass any of the following options to affect the redirect status and response
        
      
        

          
          
                # * <tt>status</tt>     - Redirect with a custom status (default is 301 Moved Permanently)
        
      
        

          
          
                # * <tt>flash</tt>      - Set a flash message when redirecting
        
      
        

          
          
                # * <tt>alert</tt>      - Set an alert message when redirecting
        
      
        

          
          
                # * <tt>notice</tt>     - Set a notice message when redirecting
        
      
        

          
          
                #
        
      
        

          
          
                # ==== Action Options
        
      
        

          
          
                # You can pass any of the following options to affect the before_action callback
        
      
        

          
          
                # * <tt>only</tt>       - The callback should be run only for this action
        
      
        

          
          
                # * <tt>except</tt>     - The callback should be run for all actions except this action
        
      
        

          
          
                # * <tt>if</tt>         - A symbol naming an instance method or a proc; the callback
        
      
        

          
          
                #                         will be called only when it returns a true value.
        
      
        

          
          
                # * <tt>unless</tt>     - A symbol naming an instance method or a proc; the callback
        
      
        

          
          
                #                         will be called only when it returns a false value.
        
      
        

          1
          
                def force_ssl(options = {})
        
      
        

          
          
                  action_options = options.slice(*ACTION_OPTIONS)
        
      
        

          
          
                  redirect_options = options.except(*ACTION_OPTIONS)
        
      
        

          
          
                  before_action(action_options) do
        
      
        

          
          
                    force_ssl_redirect(redirect_options)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Redirect the existing request to use the HTTPS protocol.
        
      
        

          
          
              #
        
      
        

          
          
              # ==== Parameters
        
      
        

          
          
              # * <tt>host_or_options</tt> - Either a host name or any of the url & redirect options
        
      
        

          
          
              #                              available to the <tt>force_ssl</tt> method.
        
      
        

          1
          
              def force_ssl_redirect(host_or_options = nil)
        
      
        

          
          
                unless request.ssl?
        
      
        

          
          
                  options = {
        
      
        

          
          
                    :protocol => 'https://',
        
      
        

          
          
                    :host     => request.host,
        
      
        

          
          
                    :path     => request.fullpath,
        
      
        

          
          
                    :status   => :moved_permanently
        
      
        

          
          
                  }
        
      
        

          
          
          
        
      
        

          
          
                  if host_or_options.is_a?(Hash)
        
      
        

          
          
                    options.merge!(host_or_options)
        
      
        

          
          
                  elsif host_or_options
        
      
        

          
          
                    options[:host] = host_or_options
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  secure_url = ActionDispatch::Http::URL.url_for(options.slice(*URL_OPTIONS))
        
      
        

          
          
                  flash.keep if respond_to?(:flash)
        
      
        

          
          
                  redirect_to secure_url, options.slice(*REDIRECT_OPTIONS)
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController
        
      
        

          1
          
            module Head
        
      
        

          
          
              # Returns a response that has no content (merely headers). The options
        
      
        

          
          
              # argument is interpreted to be a hash of header names and values.
        
      
        

          
          
              # This allows you to easily return a response that consists only of
        
      
        

          
          
              # significant headers:
        
      
        

          
          
              #
        
      
        

          
          
              #   head :created, location: person_path(@person)
        
      
        

          
          
              #
        
      
        

          
          
              #   head :created, location: @person
        
      
        

          
          
              #
        
      
        

          
          
              # It can also be used to return exceptional conditions:
        
      
        

          
          
              #
        
      
        

          
          
              #   return head(:method_not_allowed) unless request.post?
        
      
        

          
          
              #   return head(:bad_request) unless valid_request?
        
      
        

          
          
              #   render
        
      
        

          
          
              #
        
      
        

          
          
              # See Rack::Utils::SYMBOL_TO_STATUS_CODE for a full list of valid +status+ symbols.
        
      
        

          1
          
              def head(status, options = {})
        
      
        

          
          
                options, status = status, nil if status.is_a?(Hash)
        
      
        

          
          
                status ||= options.delete(:status) || :ok
        
      
        

          
          
                location = options.delete(:location)
        
      
        

          
          
                content_type = options.delete(:content_type)
        
      
        

          
          
          
        
      
        

          
          
                options.each do |key, value|
        
      
        

          
          
                  headers[key.to_s.dasherize.split('-').each { |v| v[0] = v[0].chr.upcase }.join('-')] = value.to_s
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                self.status = status
        
      
        

          
          
                self.location = url_for(location) if location
        
      
        

          
          
          
        
      
        

          
          
                self.response_body = ""
        
      
        

          
          
          
        
      
        

          
          
                if include_content?(self.response_code)
        
      
        

          
          
                  self.content_type = content_type || (Mime[formats.first] if formats)
        
      
        

          
          
                  self.response.charset = false if self.response
        
      
        

          
          
                else
        
      
        

          
          
                  headers.delete('Content-Type')
        
      
        

          
          
                  headers.delete('Content-Length')
        
      
        

          
          
                end
        
      
        

          
          
                
        
      
        

          
          
                true
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              private
        
      
        

          
          
              # :nodoc:
        
      
        

          1
          
              def include_content?(status)
        
      
        

          
          
                case status
        
      
        

          
          
                when 100..199
        
      
        

          
          
                  false
        
      
        

          
          
                when 204, 205, 304
        
      
        

          
          
                  false
        
      
        

          
          
                else
        
      
        

          
          
                  true
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # Adds the ability to prevent public methods on a controller to be called as actions.
        
      
        

          1
          
            module HideActions
        
      
        

          1
          
              extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
              included do
        
      
        

          1
          
                class_attribute :hidden_actions
        
      
        

          1
          
                self.hidden_actions = Set.new.freeze
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
            private
        
      
        

          
          
          
        
      
        

          
          
              # Overrides AbstractController::Base#action_method? to return false if the
        
      
        

          
          
              # action name is in the list of hidden actions.
        
      
        

          1
          
              def method_for_action(action_name)
        
      
        

          16
          
                self.class.visible_action?(action_name) && super
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              module ClassMethods
        
      
        

          
          
                # Sets all of the actions passed in as hidden actions.
        
      
        

          
          
                #
        
      
        

          
          
                # ==== Parameters
        
      
        

          
          
                # * <tt>args</tt> - A list of actions
        
      
        

          1
          
                def hide_action(*args)
        
      
        

          
          
                  self.hidden_actions = hidden_actions.dup.merge(args.map(&:to_s)).freeze
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def visible_action?(action_name)
        
      
        

          16
          
                  not hidden_actions.include?(action_name)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Overrides AbstractController::Base#action_methods to remove any methods
        
      
        

          
          
                # that are listed as hidden methods.
        
      
        

          1
          
                def action_methods
        
      
        

          172
          
                  @action_methods ||= Set.new(super.reject { |name| hidden_actions.include?(name) }).freeze
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          require 'base64'
        
      
        

          
          
          
        
      
        

          1
          
          module ActionController
        
      
        

          
          
            # Makes it dead easy to do HTTP Basic, Digest and Token authentication.
        
      
        

          1
          
            module HttpAuthentication
        
      
        

          
          
              # Makes it dead easy to do HTTP \Basic authentication.
        
      
        

          
          
              #
        
      
        

          
          
              # === Simple \Basic example
        
      
        

          
          
              #
        
      
        

          
          
              #   class PostsController < ApplicationController
        
      
        

          
          
              #     http_basic_authenticate_with name: "dhh", password: "secret", except: :index
        
      
        

          
          
              #
        
      
        

          
          
              #     def index
        
      
        

          
          
              #       render plain: "Everyone can see me!"
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     def edit
        
      
        

          
          
              #       render plain: "I'm only accessible if you know the password"
        
      
        

          
          
              #     end
        
      
        

          
          
              #  end
        
      
        

          
          
              #
        
      
        

          
          
              # === Advanced \Basic example
        
      
        

          
          
              #
        
      
        

          
          
              # Here is a more advanced \Basic example where only Atom feeds and the XML API is protected by HTTP authentication,
        
      
        

          
          
              # the regular HTML interface is protected by a session approach:
        
      
        

          
          
              #
        
      
        

          
          
              #   class ApplicationController < ActionController::Base
        
      
        

          
          
              #     before_action :set_account, :authenticate
        
      
        

          
          
              #
        
      
        

          
          
              #     protected
        
      
        

          
          
              #       def set_account
        
      
        

          
          
              #         @account = Account.find_by(url_name: request.subdomains.first)
        
      
        

          
          
              #       end
        
      
        

          
          
              #
        
      
        

          
          
              #       def authenticate
        
      
        

          
          
              #         case request.format
        
      
        

          
          
              #         when Mime::XML, Mime::ATOM
        
      
        

          
          
              #           if user = authenticate_with_http_basic { |u, p| @account.users.authenticate(u, p) }
        
      
        

          
          
              #             @current_user = user
        
      
        

          
          
              #           else
        
      
        

          
          
              #             request_http_basic_authentication
        
      
        

          
          
              #           end
        
      
        

          
          
              #         else
        
      
        

          
          
              #           if session_authenticated?
        
      
        

          
          
              #             @current_user = @account.users.find(session[:authenticated][:user_id])
        
      
        

          
          
              #           else
        
      
        

          
          
              #             redirect_to(login_url) and return false
        
      
        

          
          
              #           end
        
      
        

          
          
              #         end
        
      
        

          
          
              #       end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # In your integration tests, you can do something like this:
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_access_granted_from_xml
        
      
        

          
          
              #     @request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials(users(:dhh).name, users(:dhh).password)
        
      
        

          
          
              #     get "/notes/1.xml"
        
      
        

          
          
              #
        
      
        

          
          
              #     assert_equal 200, status
        
      
        

          
          
              #   end
        
      
        

          1
          
              module Basic
        
      
        

          1
          
                extend self
        
      
        

          
          
          
        
      
        

          1
          
                module ControllerMethods
        
      
        

          1
          
                  extend ActiveSupport::Concern
        
      
        

          
          
          
        
      
        

          1
          
                  module ClassMethods
        
      
        

          1
          
                    def http_basic_authenticate_with(options = {})
        
      
        

          
          
                      before_action(options.except(:name, :password, :realm)) do
        
      
        

          
          
                        authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
        
      
        

          
          
                          name == options[:name] && password == options[:password]
        
      
        

          
          
                        end
        
      
        

          
          
                      end
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def authenticate_or_request_with_http_basic(realm = "Application", &login_procedure)
        
      
        

          
          
                    authenticate_with_http_basic(&login_procedure) || request_http_basic_authentication(realm)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def authenticate_with_http_basic(&login_procedure)
        
      
        

          
          
                    HttpAuthentication::Basic.authenticate(request, &login_procedure)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def request_http_basic_authentication(realm = "Application")
        
      
        

          
          
                    HttpAuthentication::Basic.authentication_request(self, realm)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def authenticate(request, &login_procedure)
        
      
        

          
          
                  if has_basic_credentials?(request)
        
      
        

          
          
                    login_procedure.call(*user_name_and_password(request))
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def has_basic_credentials?(request)
        
      
        

          
          
                  request.authorization.present? && (auth_scheme(request) == 'Basic')
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def user_name_and_password(request)
        
      
        

          
          
                  decode_credentials(request).split(':', 2)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def decode_credentials(request)
        
      
        

          
          
                  ::Base64.decode64(auth_param(request) || '')
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def auth_scheme(request)
        
      
        

          
          
                  request.authorization.split(' ', 2).first
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def auth_param(request)
        
      
        

          
          
                  request.authorization.split(' ', 2).second
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def encode_credentials(user_name, password)
        
      
        

          
          
                  "Basic #{::Base64.strict_encode64("#{user_name}:#{password}")}"
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def authentication_request(controller, realm)
        
      
        

          
          
                  controller.headers["WWW-Authenticate"] = %(Basic realm="#{realm.gsub(/"/, "")}")
        
      
        

          
          
                  controller.status = 401
        
      
        

          
          
                  controller.response_body = "HTTP Basic: Access denied.\n"
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Makes it dead easy to do HTTP \Digest authentication.
        
      
        

          
          
              #
        
      
        

          
          
              # === Simple \Digest example
        
      
        

          
          
              #
        
      
        

          
          
              #   require 'digest/md5'
        
      
        

          
          
              #   class PostsController < ApplicationController
        
      
        

          
          
              #     REALM = "SuperSecret"
        
      
        

          
          
              #     USERS = {"dhh" => "secret", #plain text password
        
      
        

          
          
              #              "dap" => Digest::MD5.hexdigest(["dap",REALM,"secret"].join(":"))}  #ha1 digest password
        
      
        

          
          
              #
        
      
        

          
          
              #     before_action :authenticate, except: [:index]
        
      
        

          
          
              #
        
      
        

          
          
              #     def index
        
      
        

          
          
              #       render plain: "Everyone can see me!"
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     def edit
        
      
        

          
          
              #       render plain: "I'm only accessible if you know the password"
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     private
        
      
        

          
          
              #       def authenticate
        
      
        

          
          
              #         authenticate_or_request_with_http_digest(REALM) do |username|
        
      
        

          
          
              #           USERS[username]
        
      
        

          
          
              #         end
        
      
        

          
          
              #       end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              # === Notes
        
      
        

          
          
              #
        
      
        

          
          
              # The +authenticate_or_request_with_http_digest+ block must return the user's password
        
      
        

          
          
              # or the ha1 digest hash so the framework can appropriately hash to check the user's
        
      
        

          
          
              # credentials. Returning +nil+ will cause authentication to fail.
        
      
        

          
          
              #
        
      
        

          
          
              # Storing the ha1 hash: MD5(username:realm:password), is better than storing a plain password. If
        
      
        

          
          
              # the password file or database is compromised, the attacker would be able to use the ha1 hash to
        
      
        

          
          
              # authenticate as the user at this +realm+, but would not have the user's password to try using at
        
      
        

          
          
              # other sites.
        
      
        

          
          
              #
        
      
        

          
          
              # In rare instances, web servers or front proxies strip authorization headers before
        
      
        

          
          
              # they reach your application. You can debug this situation by logging all environment
        
      
        

          
          
              # variables, and check for HTTP_AUTHORIZATION, amongst others.
        
      
        

          1
          
              module Digest
        
      
        

          1
          
                extend self
        
      
        

          
          
          
        
      
        

          1
          
                module ControllerMethods
        
      
        

          1
          
                  def authenticate_or_request_with_http_digest(realm = "Application", &password_procedure)
        
      
        

          
          
                    authenticate_with_http_digest(realm, &password_procedure) || request_http_digest_authentication(realm)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  # Authenticate with HTTP Digest, returns true or false
        
      
        

          1
          
                  def authenticate_with_http_digest(realm = "Application", &password_procedure)
        
      
        

          
          
                    HttpAuthentication::Digest.authenticate(request, realm, &password_procedure)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  # Render output including the HTTP Digest authentication header
        
      
        

          1
          
                  def request_http_digest_authentication(realm = "Application", message = nil)
        
      
        

          
          
                    HttpAuthentication::Digest.authentication_request(self, realm, message)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Returns false on a valid response, true otherwise
        
      
        

          1
          
                def authenticate(request, realm, &password_procedure)
        
      
        

          
          
                  request.authorization && validate_digest_response(request, realm, &password_procedure)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Returns false unless the request credentials response value matches the expected value.
        
      
        

          
          
                # First try the password as a ha1 digest password. If this fails, then try it as a plain
        
      
        

          
          
                # text password.
        
      
        

          1
          
                def validate_digest_response(request, realm, &password_procedure)
        
      
        

          
          
                  secret_key  = secret_token(request)
        
      
        

          
          
                  credentials = decode_credentials_header(request)
        
      
        

          
          
                  valid_nonce = validate_nonce(secret_key, request, credentials[:nonce])
        
      
        

          
          
          
        
      
        

          
          
                  if valid_nonce && realm == credentials[:realm] && opaque(secret_key) == credentials[:opaque]
        
      
        

          
          
                    password = password_procedure.call(credentials[:username])
        
      
        

          
          
                    return false unless password
        
      
        

          
          
          
        
      
        

          
          
                    method = request.env['rack.methodoverride.original_method'] || request.env['REQUEST_METHOD']
        
      
        

          
          
                    uri    = credentials[:uri]
        
      
        

          
          
          
        
      
        

          
          
                    [true, false].any? do |trailing_question_mark|
        
      
        

          
          
                      [true, false].any? do |password_is_ha1|
        
      
        

          
          
                        _uri = trailing_question_mark ? uri + "?" : uri
        
      
        

          
          
                        expected = expected_response(method, _uri, credentials, password, password_is_ha1)
        
      
        

          
          
                        expected == credentials[:response]
        
      
        

          
          
                      end
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Returns the expected response for a request of +http_method+ to +uri+ with the decoded +credentials+ and the expected +password+
        
      
        

          
          
                # Optional parameter +password_is_ha1+ is set to +true+ by default, since best practice is to store ha1 digest instead
        
      
        

          
          
                # of a plain-text password.
        
      
        

          1
          
                def expected_response(http_method, uri, credentials, password, password_is_ha1=true)
        
      
        

          
          
                  ha1 = password_is_ha1 ? password : ha1(credentials, password)
        
      
        

          
          
                  ha2 = ::Digest::MD5.hexdigest([http_method.to_s.upcase, uri].join(':'))
        
      
        

          
          
                  ::Digest::MD5.hexdigest([ha1, credentials[:nonce], credentials[:nc], credentials[:cnonce], credentials[:qop], ha2].join(':'))
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def ha1(credentials, password)
        
      
        

          
          
                  ::Digest::MD5.hexdigest([credentials[:username], credentials[:realm], password].join(':'))
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def encode_credentials(http_method, credentials, password, password_is_ha1)
        
      
        

          
          
                  credentials[:response] = expected_response(http_method, credentials[:uri], credentials, password, password_is_ha1)
        
      
        

          
          
                  "Digest " + credentials.sort_by {|x| x[0].to_s }.map {|v| "#{v[0]}='#{v[1]}'" }.join(', ')
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def decode_credentials_header(request)
        
      
        

          
          
                  decode_credentials(request.authorization)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def decode_credentials(header)
        
      
        

          
          
                  ActiveSupport::HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/, '').split(',').map do |pair|
        
      
        

          
          
                    key, value = pair.split('=', 2)
        
      
        

          
          
                    [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
        
      
        

          
          
                  end]
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def authentication_header(controller, realm)
        
      
        

          
          
                  secret_key = secret_token(controller.request)
        
      
        

          
          
                  nonce = self.nonce(secret_key)
        
      
        

          
          
                  opaque = opaque(secret_key)
        
      
        

          
          
                  controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce}", opaque="#{opaque}")
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def authentication_request(controller, realm, message = nil)
        
      
        

          
          
                  message ||= "HTTP Digest: Access denied.\n"
        
      
        

          
          
                  authentication_header(controller, realm)
        
      
        

          
          
                  controller.status = 401
        
      
        

          
          
                  controller.response_body = message
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def secret_token(request)
        
      
        

          
          
                  key_generator  = request.env["action_dispatch.key_generator"]
        
      
        

          
          
                  http_auth_salt = request.env["action_dispatch.http_auth_salt"]
        
      
        

          
          
                  key_generator.generate_key(http_auth_salt)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Uses an MD5 digest based on time to generate a value to be used only once.
        
      
        

          
          
                #
        
      
        

          
          
                # A server-specified data string which should be uniquely generated each time a 401 response is made.
        
      
        

          
          
                # It is recommended that this string be base64 or hexadecimal data.
        
      
        

          
          
                # Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
        
      
        

          
          
                #
        
      
        

          
          
                # The contents of the nonce are implementation dependent.
        
      
        

          
          
                # The quality of the implementation depends on a good choice.
        
      
        

          
          
                # A nonce might, for example, be constructed as the base 64 encoding of
        
      
        

          
          
                #
        
      
        

          
          
                #   time-stamp H(time-stamp ":" ETag ":" private-key)
        
      
        

          
          
                #
        
      
        

          
          
                # where time-stamp is a server-generated time or other non-repeating value,
        
      
        

          
          
                # ETag is the value of the HTTP ETag header associated with the requested entity,
        
      
        

          
          
                # and private-key is data known only to the server.
        
      
        

          
          
                # With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
        
      
        

          
          
                # reject the request if it did not match the nonce from that header or
        
      
        

          
          
                # if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
        
      
        

          
          
                # The inclusion of the ETag prevents a replay request for an updated version of the resource.
        
      
        

          
          
                # (Note: including the IP address of the client in the nonce would appear to offer the server the ability
        
      
        

          
          
                # to limit the reuse of the nonce to the same client that originally got it.
        
      
        

          
          
                # However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
        
      
        

          
          
                # Also, IP address spoofing is not that hard.)
        
      
        

          
          
                #
        
      
        

          
          
                # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
        
      
        

          
          
                # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
        
      
        

          
          
                # POST, PUT, or PATCH requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
        
      
        

          
          
                # of this document.
        
      
        

          
          
                #
        
      
        

          
          
                # The nonce is opaque to the client. Composed of Time, and hash of Time with secret
        
      
        

          
          
                # key from the Rails session secret generated upon creation of project. Ensures
        
      
        

          
          
                # the time cannot be modified by client.
        
      
        

          1
          
                def nonce(secret_key, time = Time.now)
        
      
        

          
          
                  t = time.to_i
        
      
        

          
          
                  hashed = [t, secret_key]
        
      
        

          
          
                  digest = ::Digest::MD5.hexdigest(hashed.join(":"))
        
      
        

          
          
                  ::Base64.strict_encode64("#{t}:#{digest}")
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Might want a shorter timeout depending on whether the request
        
      
        

          
          
                # is a PATCH, PUT, or POST, and if client is browser or web service.
        
      
        

          
          
                # Can be much shorter if the Stale directive is implemented. This would
        
      
        

          
          
                # allow a user to use new nonce without prompting user again for their
        
      
        

          
          
                # username and password.
        
      
        

          1
          
                def validate_nonce(secret_key, request, value, seconds_to_timeout=5*60)
        
      
        

          
          
                  return false if value.nil?
        
      
        

          
          
                  t = ::Base64.decode64(value).split(":").first.to_i
        
      
        

          
          
                  nonce(secret_key, t) == value && (t - Time.now.to_i).abs <= seconds_to_timeout
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Opaque based on random generation - but changing each request?
        
      
        

          1
          
                def opaque(secret_key)
        
      
        

          
          
                  ::Digest::MD5.hexdigest(secret_key)
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              # Makes it dead easy to do HTTP Token authentication.
        
      
        

          
          
              #
        
      
        

          
          
              # Simple Token example:
        
      
        

          
          
              #
        
      
        

          
          
              #   class PostsController < ApplicationController
        
      
        

          
          
              #     TOKEN = "secret"
        
      
        

          
          
              #
        
      
        

          
          
              #     before_action :authenticate, except: [ :index ]
        
      
        

          
          
              #
        
      
        

          
          
              #     def index
        
      
        

          
          
              #       render plain: "Everyone can see me!"
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     def edit
        
      
        

          
          
              #       render plain: "I'm only accessible if you know the password"
        
      
        

          
          
              #     end
        
      
        

          
          
              #
        
      
        

          
          
              #     private
        
      
        

          
          
              #       def authenticate
        
      
        

          
          
              #         authenticate_or_request_with_http_token do |token, options|
        
      
        

          
          
              #           token == TOKEN
        
      
        

          
          
              #         end
        
      
        

          
          
              #       end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              #
        
      
        

          
          
              # Here is a more advanced Token example where only Atom feeds and the XML API is protected by HTTP token authentication,
        
      
        

          
          
              # the regular HTML interface is protected by a session approach:
        
      
        

          
          
              #
        
      
        

          
          
              #   class ApplicationController < ActionController::Base
        
      
        

          
          
              #     before_action :set_account, :authenticate
        
      
        

          
          
              #
        
      
        

          
          
              #     protected
        
      
        

          
          
              #       def set_account
        
      
        

          
          
              #         @account = Account.find_by(url_name: request.subdomains.first)
        
      
        

          
          
              #       end
        
      
        

          
          
              #
        
      
        

          
          
              #       def authenticate
        
      
        

          
          
              #         case request.format
        
      
        

          
          
              #         when Mime::XML, Mime::ATOM
        
      
        

          
          
              #           if user = authenticate_with_http_token { |t, o| @account.users.authenticate(t, o) }
        
      
        

          
          
              #             @current_user = user
        
      
        

          
          
              #           else
        
      
        

          
          
              #             request_http_token_authentication
        
      
        

          
          
              #           end
        
      
        

          
          
              #         else
        
      
        

          
          
              #           if session_authenticated?
        
      
        

          
          
              #             @current_user = @account.users.find(session[:authenticated][:user_id])
        
      
        

          
          
              #           else
        
      
        

          
          
              #             redirect_to(login_url) and return false
        
      
        

          
          
              #           end
        
      
        

          
          
              #         end
        
      
        

          
          
              #       end
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              #
        
      
        

          
          
              # In your integration tests, you can do something like this:
        
      
        

          
          
              #
        
      
        

          
          
              #   def test_access_granted_from_xml
        
      
        

          
          
              #     get(
        
      
        

          
          
              #       "/notes/1.xml", nil,
        
      
        

          
          
              #       'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Token.encode_credentials(users(:dhh).token)
        
      
        

          
          
              #     )
        
      
        

          
          
              #
        
      
        

          
          
              #     assert_equal 200, status
        
      
        

          
          
              #   end
        
      
        

          
          
              #
        
      
        

          
          
              #
        
      
        

          
          
              # On shared hosts, Apache sometimes doesn't pass authentication headers to
        
      
        

          
          
              # FCGI instances. If your environment matches this description and you cannot
        
      
        

          
          
              # authenticate, try this rule in your Apache setup:
        
      
        

          
          
              #
        
      
        

          
          
              #   RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]
        
      
        

          1
          
              module Token
        
      
        

          1
          
                TOKEN_KEY = 'token='
        
      
        

          1
          
                TOKEN_REGEX = /^Token /
        
      
        

          1
          
                AUTHN_PAIR_DELIMITERS = /(?:,|;|\t+)/
        
      
        

          1
          
                extend self
        
      
        

          
          
          
        
      
        

          1
          
                module ControllerMethods
        
      
        

          1
          
                  def authenticate_or_request_with_http_token(realm = "Application", &login_procedure)
        
      
        

          
          
                    authenticate_with_http_token(&login_procedure) || request_http_token_authentication(realm)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def authenticate_with_http_token(&login_procedure)
        
      
        

          
          
                    Token.authenticate(self, &login_procedure)
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          1
          
                  def request_http_token_authentication(realm = "Application")
        
      
        

          
          
                    Token.authentication_request(self, realm)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # If token Authorization header is present, call the login
        
      
        

          
          
                # procedure with the present token and options.
        
      
        

          
          
                #
        
      
        

          
          
                # [controller]
        
      
        

          
          
                #   ActionController::Base instance for the current request.
        
      
        

          
          
                #
        
      
        

          
          
                # [login_procedure]
        
      
        

          
          
                #   Proc to call if a token is present. The Proc should take two arguments:
        
      
        

          
          
                #
        
      
        

          
          
                #     authenticate(controller) { |token, options| ... }
        
      
        

          
          
                #
        
      
        

          
          
                # Returns the return value of <tt>login_procedure</tt> if a
        
      
        

          
          
                # token is found. Returns <tt>nil</tt> if no token is found.
        
      
        

          
          
          
        
      
        

          1
          
                def authenticate(controller, &login_procedure)
        
      
        

          
          
                  token, options = token_and_options(controller.request)
        
      
        

          
          
                  unless token.blank?
        
      
        

          
          
                    login_procedure.call(token, options)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Parses the token and options out of the token authorization header. If
        
      
        

          
          
                # the header looks like this:
        
      
        

          
          
                #   Authorization: Token token="abc", nonce="def"
        
      
        

          
          
                # Then the returned token is "abc", and the options is {nonce: "def"}
        
      
        

          
          
                #
        
      
        

          
          
                # request - ActionDispatch::Request instance with the current headers.
        
      
        

          
          
                #
        
      
        

          
          
                # Returns an Array of [String, Hash] if a token is present.
        
      
        

          
          
                # Returns nil if no token is found.
        
      
        

          1
          
                def token_and_options(request)
        
      
        

          
          
                  authorization_request = request.authorization.to_s
        
      
        

          
          
                  if authorization_request[TOKEN_REGEX]
        
      
        

          
          
                    params = token_params_from authorization_request
        
      
        

          
          
                    [params.shift[1], Hash[params].with_indifferent_access]
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          1
          
                def token_params_from(auth)
        
      
        

          
          
                  rewrite_param_values params_array_from raw_params auth
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Takes raw_params and turns it into an array of parameters
        
      
        

          1
          
                def params_array_from(raw_params)
        
      
        

          
          
                  raw_params.map { |param| param.split %r/=(.+)?/ }
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # This removes the <tt>"</tt> characters wrapping the value.
        
      
        

          1
          
                def rewrite_param_values(array_params)
        
      
        

          
          
                  array_params.each { |param| (param[1] || "").gsub! %r/^"|"$/, '' }
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # This method takes an authorization body and splits up the key-value
        
      
        

          
          
                # pairs by the standardized <tt>:</tt>, <tt>;</tt>, or <tt>\t</tt>
        
      
        

          
          
                # delimiters defined in +AUTHN_PAIR_DELIMITERS+.
        
      
        

          1
          
                def raw_params(auth)
        
      
        

          
          
                  _raw_params = auth.sub(TOKEN_REGEX, '').split(/\s*#{AUTHN_PAIR_DELIMITERS}\s*/)
        
      
        

          
          
          
        
      
        

          
          
                  if !(_raw_params.first =~ %r{\A#{TOKEN_KEY}})
        
      
        

          
          
                    _raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}"
        
      
        

          
          
                  end
        
      
        

          
          
          
        
      
        

          
          
                  _raw_params
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Encodes the given token and options into an Authorization header value.
        
      
        

          
          
                #
        
      
        

          
          
                # token   - String token.
        
      
        

          
          
                # options - optional Hash of the options.
        
      
        

          
          
                #
        
      
        

          
          
                # Returns String.
        
      
        

          1
          
                def encode_credentials(token, options = {})
        
      
        

          
          
                  values = ["#{TOKEN_KEY}#{token.to_s.inspect}"] + options.map do |key, value|
        
      
        

          
          
                    "#{key}=#{value.to_s.inspect}"
        
      
        

          
          
                  end
        
      
        

          
          
                  "Token #{values * ", "}"
        
      
        

          
          
                end
        
      
        

          
          
          
        
      
        

          
          
                # Sets a WWW-Authenticate to let the client know a token is desired.
        
      
        

          
          
                #
        
      
        

          
          
                # controller - ActionController::Base instance for the outgoing response.
        
      
        

          
          
                # realm      - String realm to use in the header.
        
      
        

          
          
                #
        
      
        

          
          
                # Returns nothing.
        
      
        

          1
          
                def authentication_request(controller, realm)
        
      
        

          
          
                  controller.headers["WWW-Authenticate"] = %(Token realm="#{realm.gsub(/"/, "")}")
        
      
        

          
          
                  controller.__send__ :render, :text => "HTTP Token: Access denied.\n", :status => :unauthorized
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          1
          
          module ActionController
        
      
        

          1
          
            module ImplicitRender
        
      
        

          1
          
              def send_action(method, *args)
        
      
        

          16
          
                ret = super
        
      
        

          16
          
                default_render unless performed?
        
      
        

          16
          
                ret
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def default_render(*args)
        
      
        

          7
          
                render(*args)
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          1
          
              def method_for_action(action_name)
        
      
        

          
          
                super || if template_exists?(action_name.to_s, _prefixes)
        
      
        

          
          
                  "default_render"
        
      
        

          16
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          end